Behind the global scam worth an estimated €100m targeting WhatsApp users with fake job offers

“Hi, I’m Amelia from Adecco Ltd. Would you be interested in flexible roles, may I share more details?”

This is a text Marc Bonvin, a macro analyst based in London, received on WhatsApp on December 20, 2022. He was looking to change jobs and the text piqued his interest, so he asked for more information.

“When the person replied, I knew this was a scam,” said Bonvin. “Amelia” was offering him “big projects” and a generous salary paid through an encrypted wallet. 

In October, he got a second text, again offering him job prospects.

Bonvin is one of thousands of people being targetted on WhatsApp by a scam that has already squeezed an estimated €100 million out from thousands of victims all over the globe, according to AI cybersecurity firm CloudSEK.

Some of the world’s largest recruitment firms, such as Reed and Hays, have all been impersonated in this phishing scam.

“Please be aware that NO Adecco representative will ever request payment of any kind from a candidate,” said Adecco, the company impersonated in the message Bonvin received.

According to Keith Rosser, who is both a group director at Reed and co-director and chair of JobsAware, a non-profit looking out for the safety of the UK labour market, this scam began in November 2022. It became “huge” in the UK, he says, from March 2023.

“We’re receiving dozens of reports a day, specifically about WhatsApp-based scams copying the names of legitimate recruitment firms, both job boards and recruitment agencies,” Rosser told Euronews Next.

JobsAware receives about 50 such complaints a day, and they believe only 5 per cent of victims reach out to them, bringing the approximate number of people getting these texts in the UK to 1,000 per day.

The UK’s communications regulator OFCOM recently found that nearly one in three Britons had encountered fake employment ads, and Rosser believes most of them were targeted by this specific WhatsApp scam.

Rosser’s hope is that the UK’s soon-to-be-approved Online Safety Bill and JobsAware’s plans for a certification scheme will help to lower the number of job scams, but the recruitment expert is pessimistic.

“Seeing how many people talk about this, my gut feeling is this is massive and we’re only seeing the tip of the iceberg,” he said.

Euronews Next reached out to the city of London Police after learning that they were working on this scam with JobsAware. “I’m afraid we aren’t able to assist with your request. We received a lot of media enquiries,” said their press manager.

We investigated further to get to the bottom of what is becoming a prolific and underreported phishing scam.

How does the scam work?

Euronews Next spoke with a dozen British WhatsApp users who had all received recruitment texts via the messaging app with minor differences. Recruiters’ names varied from Elaine to Amanda (but were always women’s names) and the numbers originated from a number of countries from Pakistan to the US.

Recruiters were looking for people to optimise data and boost online exposure and offered flexible working hours with a handsome pay of up to £300 (€344) per hour, in cryptocurrency. 

“May I share more information?” was a recurring line from their playbook.

Some users blocked the numbers, others sent back jokes, and all knew they were dealing with scammers, but no one could say exactly where the fraud originated. We contacted the scammers directly.

A Euronews Next reporter had already received two such texts, one in August and another in September, but the numbers had been deactivated. We instead contacted a WhatsApp number indicated at the end of a scam text another user had received on iMessage.

“Hi! I got a message from you for a job opportunity. Can you please tell me more about it? I’m interested,” Euronews Next texted. We were immediately asked to provide a screenshot of the text to ensure we were in touch with their “operational platform”.

It only took three minutes before someone calling themselves Stella responded with a series of texts (that appeared to be copy-pasted) explaining the new role.

The job was to “assist Digital Logic merchants in increasing product revenue” by completing tasks that shouldn’t take more than an hour’s time and would include a payment of €750, in a cryptocurrency tied to the US dollar known as Tether, if tasks were completed five days in a row.

According to Reddit, the news aggregating social platform on which hundreds of victims have detailed their ordeal, this fraud scheme is a “task scam”.

“Task scams involve a website or mobile app that claims you can earn money by completing easy tasks, such as watching a video, liking a post, or creating an order. The catch is that you can only do a limited number of tasks without upgrading your account,” explained a Reddit sub-moderator.

Paying money to get money

During this job’s “training week,” we had to click on a button to “submit orders” and earned 0.6 per cent of the price of the app for each one. Apps ranged from Facebook to Pokémon Go and Euronews Next had to order 45 of them to complete the daily tasks.

According to Digital Logic’s platform, this made us $40 (€38) in less than 15 minutes.

Our interlocuter, Stella, described the tasks as “very similar to clicking advertisements on those websites and mobile games that give some profits after clicking and watching advertisements”.

Euronews Next texted daily with Stella who replied to all messages in broken English within 30 minutes. 

After a week of training, we had to contact a customer service agent on Telegram to get a “random bonus” of $30 (€29). Our account now had $70 (€66) and Stella requested that we set up a cryptocurrency wallet to get the funds off Digital Logic’s website.

“Since our platform is an international one, we use exchange wallet [sic] to guarantee the security of every user’s funds,” she explained and recommended downloading Bitget, one of the world’s leading crypto trading platforms. Stella also said we needed to add $30 to the Digital Logic account to get “to the second set of tasks on my account”.

She said the account had to be funded “because the product data connects the real-time data of the Digital logic platform, that is why deposit is required [sic] to create real money flow data”.

She added that you had to complete five consecutive working days to receive a basic salary of around €759.

Euronews Next reached out to experts investigating this fraud who have confirmed that Digital Logic is part of a scamming network.

How could anyone fall for this scam?

Stuart McFadden, co-founder of the fraud recovery firm Refundee, said most people who request his services are actively looking for work.

“People at the moment are pretty desperate for work and there’s a lot of information online about side hustles, he explained. They also want to work from home, so it seems a little bit more normal to get a job where you’re remotely performing tasks for which you get paid,” he told Euronews Next.

“The most common scam we see is cryptocurrency scams, and [task scams are] now the second most common scam we see,” he said.

What’s more, fraudsters sometimes replicate websites of well-known firms like as eBay, according to McFadden, and add their victims to “team chats” on WhatsApp or Telegram with other supposed employees, making it more difficult for those being cheated to see through the fraud.

“But each story is a bit different,” he said.

The refund expert said scammers would let you withdraw money at first to build confidence and get you hooked.

“It’s kind of addictive because you say ‘Oh I’m just spending £30 (€35), and all I’m doing are these tasks and now I have £40 (€46)’. You see it happening all in real-time and everything is happening as you think it is,” he explained.

In reality, the money never circulates from crypto wallets to employee accounts. Rather, it goes to the accounts of fraudsters.

While the first set of tasks only require smaller amounts of self-funding – such as the one Stella requested – as the days go by, scammers request larger sums, making tasks harder to complete.

On a chat shared by one of Refundee’s clients, a company called Golden Egg requested a deposit of over £17,000 (€19,560) to finish task 38 on a string of 40 orders. That deposit would supposedly unlock the person’s salary of over £11,000 (€12,650).

“What happens if I cannot deposit the amount because it is too high,” asked the distraught employee, to which the customer agent, also named Stella, replied, “Dear, you need to complete the 40 orders, you can withdraw the money to the account within 5-15 minutes”.

What happens once you’ve been scammed?

Many of the people who have fallen for this scam have already invested so much time and money into it that they’re also driven by “loss-chasing” – a behaviour common among gamblers – which entails putting more money into the scam to make up for previous losses, according to McFadden.

That usually results in huge losses, as unlike gambling, there is no way to win in scams.

“You can never finish the tasks and they just get more and more ridiculous, said McFadden. “We’ve seen some that are over £100,000 (€115,000),” he added and mentioned one client that had lost £400,000 (€460,000) to this scam.

“The Financial Ombudsman Service in the UK upholds regulatory standards and banks are supposed to intervene and ask enough questions if they think you might be the victim of a scam,” explained the expert, who usually has clients who have lost between £10,000 (€11,500) to £20,000 (€23,000).

“Because you suddenly start sending money to a crypto exchange frequently, these transactions can be very obvious,” he said, but according to him, most authorities still miss the warning signs.

In parallel, as an increasing number of “high street banks block crypto, fraudsters ask their victims to set up accounts with online banks, which could have looser regulations, he explained.

“There’s very little public information about this type of scam so I completely understand how people fall for it,” said the expert, who also underlined the fact that most of his clients were non-native English speakers, unfamiliar with the UK job market.

“We’re quite lucky in the UK because a lot of countries don’t have similar kinds of regulations,” McFadden said, adding that this sort of scam was particularly difficult to stop because scammers could be in different jurisdictions to those of their victims.

So, does he think this scam is bigger than the UK?

“Today, we had a client from the Philippines,” McFadden said. “This scam is everywhere”.

According to him, perpetrators are targeting high income, English-speaking countries, such as Australia, the US, the UK and Asian countries. 

“It’s definitely organised crime,” he said.

This article is the first in a two-part investigative series. In the upcoming second part, find out how WebWyrm, the task scam which has already embezzled over €100 million from victims, works and who is behind it.